macos-entitlements-analyzer

Analyze macOS application entitlements for security implications, privilege escalation paths, and dangerous permissions. Use this skill whenever the user needs to audit macOS binaries for entitlements, assess security risks of entitlements, understand what specific entitlements allow, or identify privilege escalation opportunities through entitlement abuse. Trigger on any mention of macOS entitlements, code signing, TCC permissions, SIP bypass, or binary security analysis.

Jump to install

Repository: abelrguezr/hacktricks-skills
Last source activity: March 23, 2026 at 14:29
Detected SKILL.md language: English
Stars: 21
Forks: 8

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/abelrguezr/hacktricks-skills --skill macos-entitlements-analyzer

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

ai-fuzzing-assistant

AI-assisted fuzzing and vulnerability discovery. Use this skill whenever the user wants to generate fuzzing seeds, evolve grammars, analyze crashes, create proof-of-vulnerability exploits, or generate patches for discovered bugs. Trigger on mentions of fuzzing, AFL++, libFuzzer, vulnerability discovery, crash analysis, exploit generation, or security testing with LLMs.

2026-03-23

burp-mcp-integration

Set up and use Burp Suite's MCP Server extension to enable LLM-assisted passive vulnerability discovery. Use this skill whenever the user wants to integrate Burp with MCP-capable AI tools (Codex, Gemini, Ollama, Claude), configure the MCP proxy, troubleshoot handshake issues, or analyze intercepted HTTP traffic for security findings. Trigger on mentions of Burp MCP, Burp AI Agent, MCP proxy setup, or LLM-assisted traffic review.

2026-03-23

deep-learning-helper

Help users understand and implement deep learning concepts including neural networks, CNNs, RNNs, LLMs, and diffusion models. Use this skill whenever the user asks about deep learning architectures, wants to build neural networks in PyTorch, needs help with training loops, or wants to understand concepts like backpropagation, activation functions, attention mechanisms, or generative models. Make sure to use this skill for any deep learning related questions, code reviews, architecture design, or implementation help.

2026-03-23

View all from this repository

name

macos-entitlements-analyzer

description

macOS Entitlements Analyzer

A skill for analyzing macOS application entitlements and their security implications.

When to Use This Skill

Use this skill when:

Analyzing macOS binaries for dangerous entitlements
Assessing security risks of code-signed applications
Investigating privilege escalation paths through entitlements
Understanding what specific entitlements allow an application to do
Auditing applications for TCC (TCC database) access
Checking for SIP (System Integrity Protection) bypass capabilities
Reviewing entitlements in the context of macOS security research

Quick Reference: Entitlement Severity

🔴 High Severity (Critical Security Impact)

Entitlement	Impact
`com.apple.rootless.install.heritable`	Bypass SIP
`com.apple.rootless.install`	Bypass SIP
`com.apple.system-task-ports`	Get task port for any process (except kernel)
`com.apple.security.get-task-allow`	Allow code injection via debugger
`com.apple.security.cs.debugger`	Call task_for_pid() on apps with get-task-allow
`com.apple.security.cs.disable-library-validation`	Load unsigned frameworks/libraries
`com.apple.private.security.clear-library-validation`	Disable library validation via csops
`com.apple.security.cs.allow-dyld-environment-variables`	Use DYLD injection variables
`com.apple.private.tcc.manager`	Modify TCC database
`system.install.apple-software`	Install software without user permission
`com.apple.private.security.kext-management`	Load kernel extensions
`com.apple.private.icloud-account-access`	Access iCloud tokens
`kTCCServiceSystemPolicyAllFiles`	Full Disk Access
`kTCCServiceAppleEvents`	Automate/abuse other applications
`kTCCServiceAccessibility`	Control UI, approve dialogs

🟡 Medium Severity (Significant Security Impact)

Entitlement	Impact
`com.apple.security.cs.allow-jit`	Create writable+executable memory
`com.apple.security.cs.allow-unsigned-executable-memory`	Patch C code, use deprecated APIs
`com.apple.security.cs.disable-executable-page-protection`	Modify own executable on disk
`com.apple.private.nullfs_allow`	Mount nullfs filesystem
`kTCCServiceAll`	Request all TCC permissions

How to Extract Entitlements

From a Code-Signed Binary

# Extract entitlements from a binary
codesign -d --entitlements :- /path/to/binary > entitlements.xml

# Or for an app bundle
codesign -d --entitlements :- /path/to/App.app/Contents/MacOS/Executable > entitlements.xml

Parse Entitlements Programmatically

Use the extract_entitlements.sh script (see scripts/) to:

Extract entitlements from a binary
Check against known dangerous entitlements
Generate a risk assessment

Analysis Workflow

Step 1: Extract Entitlements

# Run the extraction script
./scripts/extract_entitlements.sh /path/to/binary

Step 2: Review High-Risk Entitlements

Check for these critical entitlements first:

SIP Bypass: com.apple.rootless.install*
Process Injection: com.apple.system-task-ports, com.apple.security.get-task-allow
TCC Manipulation: com.apple.private.tcc.manager, kTCCService*
Library Loading: com.apple.security.cs.disable-library-validation
Full Disk Access: kTCCServiceSystemPolicyAllFiles

Step 3: Assess Privilege Escalation Paths

Entitlement	Escalation Path
`system.install.apple-software`	Install malicious software silently
`com.apple.private.security.kext-management`	Load malicious kernel extension
`kTCCServiceSystemPolicySysAdminFiles`	Bypass TCC by changing home directory
`kTCCServiceAppleEvents`	Abuse other apps' permissions
`kTCCServiceAccessibility`	Approve security dialogs programmatically

Step 4: Check for Combined Risks

Some entitlement combinations are especially dangerous:

com.apple.security.cs.debugger + com.apple.security.get-task-allow: Full code injection capability
kTCCServiceAccessibility + kTCCServiceAppleEvents: Complete UI automation and app control
com.apple.security.cs.disable-library-validation + com.apple.security.cs.allow-dyld-environment-variables: Multiple code injection vectors

Common Use Cases

Case 1: Auditing a Suspicious Application

# Extract and analyze
codesign -d --entitlements :- /Applications/SuspiciousApp.app/Contents/MacOS/SuspiciousApp > /tmp/entitlements.xml
./scripts/extract_entitlements.sh /Applications/SuspiciousApp.app/Contents/MacOS/SuspiciousApp

Case 2: Checking for iCloud Token Access

Look for com.apple.private.icloud-account-access - this allows communication with iCloudHelper XPC service to obtain iCloud tokens. Known to be present in iMovie and GarageBand.

Case 3: TCC Database Manipulation

Check for:

com.apple.private.tcc.manager
com.apple.rootless.storage.TCC
kTCCServiceEndpointSecurityClient

These allow modification of the TCC database, which controls privacy permissions.

Important Notes

Apple-Only Entitlements

Entitlements starting with com.apple are typically reserved for Apple. However:

Enterprise certificates can create custom com.apple.* entitlements
This can bypass protections that check for Apple-signed binaries

TCC Services

TCC (Transparency, Consent, and Control) services control privacy permissions:

Service	Permission
`kTCCServiceSystemPolicyAllFiles`	Full Disk Access
`kTCCServiceAppleEvents`	Automate other apps
`kTCCServiceAccessibility`	Accessibility/Screen Control
`kTCCServiceEndpointSecurityClient`	Write TCC database
`kTCCServiceSystemPolicySysAdminFiles`	Change NFS home directory
`kTCCServiceSystemPolicyAppBundles`	Modify app bundle contents

Trustcache/CDhash Bypass

Some entitlements can bypass Trustcache/CDhash protections that prevent execution of downgraded Apple binaries. Research ongoing.

Example Analysis Output

=== Entitlement Analysis ===
Binary: /Applications/Example.app/Contents/MacOS/Example

🔴 HIGH RISK ENTITLEMENTS FOUND:
- com.apple.security.get-task-allow: Allows code injection
- kTCCServiceAccessibility: Can control UI and approve dialogs

🟡 MEDIUM RISK ENTITLEMENTS:
- com.apple.security.cs.allow-jit: Writable+executable memory

✅ No critical SIP bypass entitlements
✅ No TCC database modification entitlements

RECOMMENDATION: Review code injection capabilities and accessibility permissions

Scripts Available

scripts/extract_entitlements.sh - Extract and analyze entitlements from a binary
scripts/check_dangerous_entitlements.sh - Check for known dangerous entitlements

macos-entitlements-analyzer

Source facts

Install options

Review the source files

More from this repository

More from this repository

macOS Entitlements Analyzer

When to Use This Skill

Quick Reference: Entitlement Severity

🔴 High Severity (Critical Security Impact)

🟡 Medium Severity (Significant Security Impact)

How to Extract Entitlements

From a Code-Signed Binary

Parse Entitlements Programmatically

Analysis Workflow

Step 1: Extract Entitlements

Step 2: Review High-Risk Entitlements

Step 3: Assess Privilege Escalation Paths

Step 4: Check for Combined Risks

Common Use Cases

Case 1: Auditing a Suspicious Application

Case 2: Checking for iCloud Token Access

Case 3: TCC Database Manipulation

Important Notes

Apple-Only Entitlements

TCC Services

Trustcache/CDhash Bypass

Example Analysis Output

Scripts Available

References

macOS Entitlements Analyzer

When to Use This Skill

Quick Reference: Entitlement Severity

🔴 High Severity (Critical Security Impact)

🟡 Medium Severity (Significant Security Impact)

How to Extract Entitlements

From a Code-Signed Binary

Parse Entitlements Programmatically

Analysis Workflow

Step 1: Extract Entitlements

Step 2: Review High-Risk Entitlements

Step 3: Assess Privilege Escalation Paths

Step 4: Check for Combined Risks

Common Use Cases

Case 1: Auditing a Suspicious Application

Case 2: Checking for iCloud Token Access

Case 3: TCC Database Manipulation

Important Notes

Apple-Only Entitlements

TCC Services

Trustcache/CDhash Bypass

Example Analysis Output

Scripts Available

References